huawei-cloud-iam-manage
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the
hcloudCLI and a telemetry toolskill-quality-clifrom official Huawei Cloud domains (huaweicloud.comandmyhuaweicloud.com). These sources are recognized as official vendor infrastructure. - [COMMAND_EXECUTION]: The skill executes
hcloudCLI commands to manage identity configurations, including creating users, groups, and policies. It incorporates strict safety protocols, requiring user confirmation for all write operations and warnings for high-authority grants. - [PERSISTENCE]: The installation scripts
ensure_cli.shandinstall_cli.shmodify shell profile files (~/.bashrc,~/.profile) to add local bin directories to thePATH. This is standard behavior for ensuring CLI tools are accessible across sessions. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data from Huawei Cloud IAM APIs. While this creates a potential surface for indirect injection, the skill mitigates this by using structured JSON inputs for sensitive data and requiring explicit human-in-the-loop confirmation for all management actions.
- [CREDENTIALS_SAFE]: The skill manages Secret Access Keys (SK) and passwords but adheres to secure practices: SKs are displayed only once and not stored, and passwords are passed via temporary JSON files that are immediately deleted after use.
Audit Metadata